CVE-2025-12353: WPFunnels <= 3.6.2 - Unauthorized User Registration
The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optinallowregistration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12353?
CVE-2025-12353 has a high severity level because it allows unauthorized user registration, potentially compromising the website.
How do I fix CVE-2025-12353?
To fix CVE-2025-12353, update the WPFunnels plugin to version 3.6.3 or later, where the vulnerability is addressed.
What versions of WPFunnels are affected by CVE-2025-12353?
CVE-2025-12353 affects all versions of the WPFunnels plugin up to and including version 3.6.2.
Who is affected by CVE-2025-12353?
Any WordPress site using the WPFunnels plugin version 3.6.2 or earlier is at risk from CVE-2025-12353.
What type of attack can CVE-2025-12353 facilitate?
CVE-2025-12353 can facilitate unauthorized user registrations, leading to potential account misuse or spam on affected WordPress sites.